✨ Add MFA for all users, with admin lockout when none active (LK-C17) - #139
Merged
Conversation
TOTP and email one-time codes, independently toggleable in /app/settings, backed by bcrypt-hashed recovery codes shown once on first activation. Login gains an intermediate MFA challenge step (method picker when both are active, straight to code entry otherwise). Admin routes now 403 with MFA_REQUIRED when the account has no active method — checked live, no grace period, since there's no field recording when an account became admin. Also creates the follow-up Quackback tickets for generic-MFA-for-all-users (fulfilled by this change) and WebAuthn/passkey support. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
github-actions
Bot
added
documentation
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
/app/settings, avec des codes de secours (bcrypt, usage unique) générés à la première activation.AdminGuardbloque désormais les routes/admin(403MFA_REQUIRED) pour un compte admin sans aucune méthode MFA active — vérifié en direct, sans délai de grâce (pas de champ pour dater la promotion en admin).Closes https://github.com/Logan2234/loomkeep-roadmap/issues/40 (LK-C17).
Test plan
pnpm --filter @loomkeep/api test— 754/754 tests passent (dont les nouveauxmfa.service.spec.ts,mfa-crypto.util.spec.ts, extensionsauth.service.spec.ts/admin.guard.spec.ts)pnpm --filter @loomkeep/web check— 0 erreurpnpm lint— proprepnpm --filter @loomkeep/api test:e2e— à faire après application de la migration